fix session cookie lifetime (#11)